Can you get a virus via a virtual machine?

Can a virus travel from a VM to a host machine?

  • Total voters
    8
=MGN=RedEagle

=MGN=RedEagle

Well-known member
Hi guys,

If I install linux via a VM on my PC, can a virus travel through the VM and harm my PC? What I I transfer files from my VM to my PC?

Can I infect the VM from the PC by transferring data?


I should mention that you guys are awesome and have been a huge help to me! :)
 
Yes and yes. Transfer via file transfer should be obvious if the transferred file is infected. Otherwise it depends on the security of the underlying hypervisor that runs the VM. It's not unheard of that hypervisors (VirtualBox, VMWare, Xen, KVM, ...) have been be exploited, allowing an app to escape the guest and attack the host. Some reads:

http://blogs.gartner.com/neil_macdonald/2011/01/26/yes-hypervisors-are-vulnerable/
http://threatpost.com/virtual-machine-escape-exploit-targets-xen-090612/
http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php
http://vsphere-land.com/news/escaping-the-cave-a-vmware-admins-worst-fear.html
 
AlexT said:
Yes and yes. Transfer via file transfer should be obvious if the transferred file is infected. Otherwise it depends on the security of the underlying hypervisor that runs the VM. It's not unheard of that hypervisors (VirtualBox, VMWare, Xen, KVM, ...) have been be exploited, allowing an app to escape the guest and attack the host. Some reads:

http://blogs.gartner.com/neil_macdonald/2011/01/26/yes-hypervisors-are-vulnerable/
http://threatpost.com/virtual-machine-escape-exploit-targets-xen-090612/
http://www.vupen.com/blog/20120904.Advanced_Exploitation_of_Xen_Sysret_VM_Escape_CVE-2012-0217.php
http://vsphere-land.com/news/escaping-the-cave-a-vmware-admins-worst-fear.html
Click to expand...

Thanks for that input. If I move a infected drive from a PC to a linux machine, will that drive infect the linux machine? I figured the vast majority would face compatibility issues.
 
FaithFirst said:
Thanks for that input. If I move a infected drive from a PC to a linux machine, will that drive infect the linux machine? I figured the vast majority would face compatibility issues.
Click to expand...
It can. The old myth that (once fact, now myth) that there are no self executing programs in Linux ..... Is a myth today. And viruses can be cross platform as well (same thing can run on Windows, Linux, Apple, Android, iPhone, ect...).

You're better off setting up this virtual PC inside a sandbox and inside another virtual PC.

Off topic:

The evil people that make such things.... They're getting smarter and a lot of people are playing catch up to them.

The most infectiousness computer virus is a firmware that adds its self to all your firmware. It doesn't technically do anything, except add 2 lines of code (hello world) and it wasn't ever released in the wild (thankfully). But it was a good example of things to come.... Imagine having to replace all your hardware, because connecting it to something new means infecting hardware with contact.
 
Adam Howard said:
It can. The old myth that (once fact, now myth) that there are no self executing programs in Linux ..... Is a myth today. And viruses can be cross platform as well (same thing can run on Windows, Linux, Apple, Android, iPhone, ect...).

You're better off setting up this virtual PC inside a sandbox and inside another virtual PC.

Off topic:

The evil people that make such things.... They're getting smarter and a lot of people are playing catch up to them.

The most infectiousness computer virus is a firmware that adds its self to all your firmware. It doesn't technically do anything, except add 2 lines of code (hello world) and it wasn't ever released in the wild (thankfully). But it was a good example of things to come.... Imagine having to replace all your hardware, because connecting it to something new means infecting hardware with contact.
Click to expand...

Are you talking about firmware rootkits?
 
EQnoble said:
Are you talking about firmware rootkits?
Click to expand...
Something along those lines, yes. The infection was able to apply its self to things which normally you wouldn't be expecting (mouse, keyboard, bios, hard drive, ect...) If it had firmware, even stuff that typically wasn't thought flash-able... It made it.

Think "HIV" for technology.... Make any data exchange of any kind and you were infected.
 
There are prudent measures and then there's paranoia. Don't fall into the latter. Take your standard precautions, scan your machines regularly, and leave the paranoia at the door.
 
There is no 100% level of security. There will always be some level of risk by using a computer. At some point it simply becomes cost prohibitive.

The best thing to do is take the most reasonable amount of precautions possible.
 
Hi guys,

You have been a huge help! Question, is a VM in a VM safer or a separate Ubuntu computer safer? I can afford both. Just want to know which system is better if you want to protect high-value online assets which people are actively trying to hack.
 
FaithFirst said:
Hi guys,

You have been a huge help! Question, is a VM in a VM safer or a separate Ubuntu computer safer? I can afford both. Just want to know which system is better if you want to protect high-value online assets which people are actively trying to hack.
Click to expand...


Exactly how "high value" ?
 
Adam Howard said:
The most infectiousness computer virus is a firmware that adds its self to all your firmware. It doesn't technically do anything, except add 2 lines of code (hello world) and it wasn't ever released in the wild (thankfully). But it was a good example of things to come.... Imagine having to replace all your hardware, because connecting it to something new means infecting hardware with contact.
Click to expand...

Literally the only danger of spreading would be in portable hard disks that actually bother to implement firmware updates over usb, and it would be astronomically hard to exploit.
 
Luke Foreman said:
Literally the only danger of spreading would be in portable hard disks that actually bother to implement firmware updates over usb, and it would be astronomically hard to exploit.
Click to expand...
I was thinking the same thing. Sure it's not 100% secure, but it's better than any system we have now.
 
FaithFirst said:
Hi guys,

You have been a huge help! Question, is a VM in a VM safer or a separate Ubuntu computer safer? I can afford both. Just want to know which system is better if you want to protect high-value online assets which people are actively trying to hack.
Click to expand...

In that case it's probably better to consult / cooperate with a security expert instead of messing around with stuff you do not really understand, because that can be dangerous. Yes, that can cost you quite *some* $$$, because the really good people don't work for peanuts.
 
Luke Foreman said:
Literally the only danger of spreading would be in portable hard disks that actually bother to implement firmware updates over usb, and it would be astronomically hard to exploit.
Click to expand...

Not necessarily. Read up on Icelord and Mebromi. Both infect your BIOS and MBR.
 
Don't want to get too deeply into this, but don't think of a virus as a program. Think of a virus as a weapons system. You have delivery and payload. Even the payload can be complex, like a MIRV warhead. The "re-entry vehicle" can be chosen based on an IFDEF conditional in the delivery system, to select it for the proper OS, BIOS, firmware detected.

So yes, not only can a virus in a VM affect the host computer, but also the hypervisor, the BIOS. and other VMs. It can replicate itself via ethernet or the SAN and affect the entire house, office, and/or datacenter. It can leap from to different operating systems. It all depends on the sophistication of the virus. And with many countries actively wngaging in cyberwarfare, viruses are becoming increasingly sophisticated.
 
Fred Sherman said:
Don't want to get too deeply into this, but don't think of a virus as a program. Think of a virus as a weapons system. You have delivery and payload. Even the payload can be complex, like a MIRV warhead. The "re-entry vehicle" can be chosen based on an IFDEF conditional in the delivery system, to select it for the proper OS, BIOS, firmware detected.

So yes, not only can a virus in a VM affect the host computer, but also the hypervisor, the BIOS. and other VMs. It can replicate itself via ethernet or the SAN and affect the entire house, office, and/or datacenter. It can leap from to different operating systems. It all depends on the sophistication of the virus. And with many countries actively wngaging in cyberwarfare, viruses are becoming increasingly sophisticated.
Click to expand...
Do you know if they can jump via a wireless router to different computers within the same house?
 

Similar threads

Q
  • Question Question
XF 2.2 Can someone who is registered on your forum, introduce a virus or malware by posting?
Replies
3
Views
583
Quartzite
Q
Back
Top Bottom